5.5

CVE-2025-21917: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2025-21917DEBIAN-CVE-2025-21917
Published 01-04-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2025-21917 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.1% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 61 · Related 58
DLA-4178-1DLA-4193-1DSA-5900-1SUSE-SU-2025:01614-1SUSE-SU-2025:01707-1SUSE-SU-2025:01919-1

Timeline

  1. 01-04-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Unable to handle kernel NULL pointer dereference at virtual address" may occur. This issue points to the usbhsc_notify_hotplug() function. Flush the delayed work to avoid its execution when driver resources are unavailable.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu137 products
  • linuxAll versions (No fix recorded) | < 5.4.0-216.236 | < 5.15.0-140.150 | < 6.8.0-84.84
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1146.156 | < 5.15.0-1084.91 | < 6.8.0-1039.41
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ bc57381e634782009b1cb2e86b18013699ada576, < 4cd847a7b630a85493d0294ad9542c21aafaa246 | ≥ bc57381e634782009b1cb2e86b18013699ada576, < 394965f90454d6f00fe11879142b720c6c1a872e | ≥ bc57381e634782009b1cb2e86b18013699ada576, < 3248c1f833f924246cb98ce7da4569133c1b2292 | ≥ bc57381e634782009b1cb2e86b18013699ada576, < 4ca078084cdd5f32d533311d6a0b63a60dcadd41 | ≥ bc57381e634782009b1cb2e86b18013699ada576, < d50f5c0cd949593eb9a3d822b34d7b50046a06b7 | ≥ bc57381e634782009b1cb2e86b18013699ada576, < e5aac1c9b2974636db7ce796ffa6de88fa08335e | ≥ bc57381e634782009b1cb2e86b18013699ada576, < 830818c8e70c0364e377f0c243b28061ef7967eb | ≥ bc57381e634782009b1cb2e86b18013699ada576, < 552ca6b87e3778f3dd5b87842f95138162e16c82 | 3.0
  • linux_kernel≥ 3.0, < 5.4.291 | ≥ 5.5, < 5.10.235 | ≥ 5.11, < 5.15.179 | ≥ 5.16, < 6.1.131 | ≥ 6.2, < 6.6.83 | ≥ 6.7, < 6.12.19 | ≥ 6.13, < 6.13.7 | 6.14:rc1 | 6.14:rc2 | 6.14:rc3 | 6.14:rc4 | 6.14:rc5
Debian1 product
  • linux< 6.1.133-1 | < 6.12.19-1

3 vendors · 140 products

References

63 links
Show all 63 references